News

Security in your pocket: umbrella, a one-stop shop

Practice

Most organisations have the guidance their staff need. The problem is that it is in six documents, three of which are on a shared drive nobody can reach from the field.

The idea behind a single consolidated reference is not to write new guidance. It is to put the material a member of staff actually needs, in the order they need it, somewhere they can reach it when the network is poor and they have two minutes.

What belongs in it:

• Who to call. The communications tree, with names, roles and numbers, and a statement of what to do if the first person does not answer. This is the section people use most and it should be first.
• What to do first. One page per incident type: vehicle accident, checkpoint, carjacking, detention, sexual assault, medical emergency, missing person. Short enough to read under pressure.
• The standing rules. Movement, curfew, communications schedules, and the rule on what to do when a journey becomes unsafe. Stated as instructions rather than as guidance.
• Medical. Nearest suitable facility, the organisation's clinic arrangements, the evacuation route, and the insurer's assistance number.
• Key contacts. Security focal point, warden, office, partner organisations, and the embassy or consulate where relevant.

What does not belong in it: the risk assessment, the security plan and the policy. Those are documents for managers, and putting them in a field reference makes the reference unusable.

Two design decisions determine whether it works. It has to be readable offline, which in practice means it is carried as a document on the phone rather than as a page that needs a connection. And it has to be short. A reference that runs to forty pages will be read once at induction and never again.

The maintenance question is the one organisations underestimate. A field reference goes out of date in weeks: staff rotate, numbers change, and a clinic closes. If there is no named owner and no review date, the reference becomes worse than nothing, because staff will trust a number that no longer works. The rule to apply is that the reference is reviewed on the same schedule as the security plan, and that a change of security focal point triggers an immediate update rather than waiting for the next cycle.